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DETAILED ACTION 

RESPONSE TO ARGUMENTS 

Applicant's arguments with respect to claims 1, 7, 13-16, 20-21, 26, and 28-30 have been 
considered but are moot in view of the new ground(s) of rejection. 

The 1 12 rejections of the previous action have been appropriately withdrawn due to applicant's 
arguments and amendments. 

CLAIM REJECTIONS 

Claim Rejections - 35 USC § 103 

1 . The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

2. Claims 1,7,1 3-1 6, 20-21 , 26, and 28-30 rejected under 35 U.S.C. 1 03(a) as 
being unpatentable over Chen, US Patent No. 5960170, and further in view of Shipp, 
US Patent No. 7496963. 

As per claim 1, 14, 21, Chen teaches: 

A processor-readable medium comprising processor-executable instructions for: 
parsing an input file to recognize a file format of the input file to recognize a file format of the input file, 
wherein the parsing repeatedly parses once with each of a plurality of component parsers contained 
within a compound parser, wherein each of the plurality of component parsers is configured for 
recognition of a specific file format by which an input file is configured, wherein the compound parser is 
extensible, and wherein extending the compound parser comprises adding an additional component 
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parser configured to recognize an additional file format and executable code if present in a fule of the 
additional file format ; 

[see col. 1 1, lines 21-50, wherein each virus detection object is viewed as being analogous to the 
claimed component parsers and the collection of detection objects is viewed as the claimed 
compound parser and further the virus detection objects are iteratively produced which is being 
viewed as analogous to the parser being extensible.] 
checking contents of the input file, according to the recognized file format if available, to determine 
whether executable code exists within the input file, wherein the checking comprises detecting executable 
code because its location within the input file is inconsistent with the recognized file format; 
[see col. 1 1, lines 37-46] 

continuing to parse the input file until a component parser recognizes the file format of the input file or 
until all available component parsers within the compound parser have parsed the input file; and 
[see col. 13, lines 38-55] 

sending a status in response to results of said checking, wherein sending a status comprises further 
instructions for: 

sending a file-has-no-code status when the file format of the input file was recognized and no 
executable code was found; and sending a file-has-code status when executable code was 
found. 

[see col. 8, lines 1 7-24, wherein notification is sent to the virus detection server as to 
whether a virus has been detected] 
wherein adding an additional component parser comprises instructions for: 

identifying a new file format, wherein ability to recognize the new file format is functionality to be 
extended to the new compound parser; 

configuring a new component parser according to the new file format, wherein the new 
component parser is configured to recognize files of the new format by locating executable code 
in files of the new format by locating executable code that is inconsistent with the new file format; 
and 
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extending functionality of the compound parser by adding the new component parser to the 
compound parser. 

[see col. 11, lines 21-50 

] 

The Chen reference has been discussed above. While the Chen reference teaches virus detection 
objects which examiner views as analogous to the claimed component parsers, for the sake of expediting 
prosecution, it will be assumed that Chen's virus detection objects do not contain all the functionalities of 
the claimed component parsers. Such functionalities include the parsing of the input file to recognize a 
specific file type. While Chen teaches that virus detection objects are tailored for different file types, Chen 
is not explicit in teaching that the virus detection objects are able to recognize a specific file format. For 
this limitation, examiner relies upon the Shipp reference. 

Shipp teaches a file-type-analyser which searches the file code in order to determine the file format (see 
col. 4, lines 11-35). It would have been obvious to one of ordinary skill in the art to modify the Chen 
reference to include the file-type-analyser taught by Shipp in order to improve on the efficiency of the 
Chen invention. The Chen invention is already capable of scanning for viruses based on file types and 
being able to scan a file in order to determine the file type would allow the appropriate virus detection 
object to be used to scan for viruses in the appropriate file type. 

As per claim 13, Chen teaches: 

The processor-readable medium as recited in claim 11, additionally comprising further instructions for 
continuing to parse the input file with all remaining component parsers after at least one component 
parser recognizes the file format of the input file. 

[see rejection of claim 1, wherein the virus detection objects are iteratively produced. Thus, there 
are no remaining detection objects left after one successfully identifies the presence of a virus.] 



Application/Control Number: 10/769,106 
Art Unit: 2136 



Page 5 



As per claim 15, Chen teaches: 

The processor-readable medium as recited in claim 1, wherein sending a status comprises further 
instructions for: sending a file-has-no-code status when the file format of the input file was recognized and 
no executable code was found; and sending a file-has-code status when executable code was found. 
[see col. 8, lines 17-24] 

As per claim 16, 22, Chen teaches: 

The processor-readable medium as recited in claim 1, additionally comprising further instructions for 
sending a don't-know status when the file format of the input file was not recognized. 
[see col. 8, lines 17-24] 

As per claim 20, Chen teaches: 

The processor-readable medium as recited in claim 1, wherein parsing the input file comprises further 
instructions for parsing the input file repeatedly with a plurality of component parsers contained within an 
extensible parser. 

[see rejection of claim 1] 

As per claim 26, Chen teaches: 

The apparatus as recited in claim 21 , additionally configured to send the status to: a firewall; a host 
intrusion detector; or a host vulnerability assessor. 
[see fig. 1, element 400] 

As per claim 28, Chen teaches: 

The processor-readable medium as recited in claim 1, wherein parsing the input file comprises 
instructions for operating a parser configured to recognize a plurality of file formats. 
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[see rejection of claim 1] 



As per claim 29, Chen teaches: 

The apparatus as recited in claim 21, wherein the compound parser is configured to allow extension by 
addition of a new component parser to the compound parser, wherein the new component parser 
recognizes a further file format and recognizes executable code within the further file format. 

[see col. 7, lines 20-25, Chen teaches a plurality of virus detection objects are produced by the 
virus detection server and transmitted to the client. These objects are viewed by examiner to be 
analogous to the claimed "component parsers. " Col. 8, lines 1 -5 cite that the objects contain 
information allowing them to detect the type of viruses present at the client based on file type. 

As per claim 30, Chen teaches: 

The processor-readable medium as recited in claim 1, wherein adding an additional component parser 
comprises instructions for: 

identifying a new file format, wherein ability to recognize the new file format is functionality to be extended 
to the compound parser; configuring a new component parser according to the new file format, wherein 
the new component parser is configured to recognize files of the new format and also to recognize 
executable code in files of the new format by locating executable code that is inconsistent with the new 
file format; and extending functionality of the compound parser by adding the new component parser to 
the compound parser. 

[see col. 1 1, lines 21-50, wherein each iteratively produced virus detection object is tailored to 
include routines to detect viruses pertaining to a specific file type (ie. .exe or .doc) and wherein 
each object is produced and added to the already produced list of objects when it is determined 
that a virus has not yet been detected by the virus detection server.] 
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As per claim 6-8, 17-19, 23-25, 27: 

The processor-readable medium as recited in claim 1, wherein sending the status comprises further 
instructions for sending the status to an email program/instant messaging program/internet browsing 
program. 

Chen teaches alerting one or more users/administrators but does not specifically mention whether said 
alert is sent via email, IM, or browser. Depending on the user's capabilities, examiner interprets that it 
would have been obvious to send said alert via any of the above applications or any other applicable 
application. Examiner further interprets that this is merely a design choice and a certain user system's 
functionality. 

CONCLUSION 

3. Applicant's amendment necessitated the new ground(s) of rejection presented in this Office 
action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of 
the extension of time policy as set forth in 37 CFR 1 .136(a). 

A shortened statutory period for reply to this final action is set to expire THREE MONTHS from 
the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date 
of this final action and the advisory action is not mailed until after the end of the THREE-MONTH 
shortened statutory period, then the shortened statutory period will expire on the date the advisory action 
is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later than SIX 
MONTHS from the date of this final action. 

POINTS OF CONTACT 

Any response to this Office Action should be faxed to (571 ) 273-8300 or mailed to: 
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Commissioner for Patents 
P.O. Box 1450 
Alexandria, VA 22313-1450 

Hand-delivered responses should be brought to 

Customer Service Window 
Randolph Building 
401 Dulany Street 
Alexandria, VA 22314 

Any inquiry concerning this communication or earlier communications from the examiner should 
be directed to Daniel L. Hoang whose telephone number is 571-270-1019. The examiner can normally 
be reached on Monday - Thursday, 8:00 a.m. - 5:00 p.m., EST. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's supervisor, 

Nasser Moazzami can be reached on 571-272-4195. The fax phone number for the organization where 

this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application maybe obtained from the Patent Application 
Information Retrieval (PAIR) system. Status information for published applications may be 
obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR system, 
see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 



/Daniel L. Hoang/ 
Examiner, Art Unit 2436 



/Nasser G Moazzami/ 

Supervisory Patent Examiner, Art Unit 2436 



